Crash in _clutter_input_device_reset_scroll_info #678

Activity

1. chennin commented on Jan 16, 2024

   

   chennin

   on Jan 16, 2024

   Last edited by chennin

   Author

   More actions

   Still getting the crash in muffin 6.0.1-1. I can semi-regularly reproduce it by rebooting and touching nothing until auto-login completes and Steam/Discord finish starting.

   • Now on AMD 6700XT GPU
   • cinnamon 6.0.4-1
   • muffin 6.0.1-1

   Core was generated by `cinnamon --replace'.
   Program terminated with signal SIGSEGV, Segmentation fault.
   
   warning: Section `.reg-xstate/963' in core file too small.
   #0  _clutter_input_device_reset_scroll_info (device=device@entry=0x0)
       at ../muffin-6.0.1/clutter/clutter/clutter-input-device.c:1914
   Downloading source file /usr/src/debug/muffin/build/../muffin-6.0.1/clutter/clutter/clutter-input-device.c
   1914      if (device->scroll_info == NULL)
   [Current thread is 1 (Thread 0x72eddafb6fc0 (LWP 963))]
   (gdb) bt
   #0  _clutter_input_device_reset_scroll_info (device=device@entry=0x0)
       at ../muffin-6.0.1/clutter/clutter/clutter-input-device.c:1914
   #1  0x000072eddfd6040c in meta_seat_x11_translate_event
       (event=0x6174128976a0, xevent=<optimized out>, seat=<optimized out>)
       at ../muffin-6.0.1/src/backends/x11/meta-seat-x11.c:2310
   #2  meta_clutter_backend_x11_translate_event (backend=<optimized out>, native=<optimized out>, event=0x6174128976a0)
       at ../muffin-6.0.1/src/backends/x11/meta-clutter-backend-x11.c:98
   #3  0x000072eddfe24cbb in meta_x11_handle_event.isra.0 (xevent=xevent@entry=0x7ffe4a73cd60)
       at ../muffin-6.0.1/src/backends/x11/meta-event-x11.c:106
   #4  0x000072eddfd5eab2 in handle_host_xevent (event=0x7ffe4a73cd60, backend=0x6174114beae0)
       at ../muffin-6.0.1/src/backends/x11/meta-backend-x11.c:426
   #5  x_event_source_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>)
       at ../muffin-6.0.1/src/backends/x11/meta-backend-x11.c:479
   #6  0x000072ede018df69 in g_main_dispatch (context=0x6174114bba50) at ../glib/glib/gmain.c:3476
   #7  0x000072ede01ec367 in g_main_context_dispatch_unlocked (context=0x6174114bba50) at ../glib/glib/gmain.c:4284
   #8  g_main_context_iterate_unlocked.isra.0
       (context=0x6174114bba50, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
       at ../glib/glib/gmain.c:4349
   #9  0x000072ede018eb97 in g_main_loop_run (loop=0x6174118f9540) at ../glib/glib/gmain.c:4551
   #10 0x000072eddfd9ff61 in meta_run () at ../muffin-6.0.1/src/core/main.c:663
   #11 0x0000617410e7d4ad in main (argc=<optimized out>, argv=<optimized out>) at ../cinnamon-6.0.4/src/main.c:398

   core.cinnamon.1000.e7294ebb2a37412e9ced8c5eb6303994.963.1705436100000000.gz
2. github-actions commented on Mar 2, 2026

   

   github-actionsbot

   on Mar 2, 2026 – with GitHub Actions

   More actions

   This issue has been automatically marked as stale because it has not had
   any activity in over 2 years.

   If this issue is still relevant:

   • Please test on a current version of this package.
   • Add a comment with your findings

   If no activity occurs in the next 30 days, this issue will be
   automatically closed. Issues can be reopened if needed.
3. github-actions

   added

   stale

   on Mar 2, 2026
4. UweSchneider commented on Mar 6, 2026

   

   UweSchneider

   on Mar 6, 2026

   More actions

   Patch available: NULL guard in _clutter_input_device_reset_scroll_info

   This crash is a NULL pointer dereference where device=0x0 is passed to _clutter_input_device_reset_scroll_info. The existing code checks device->scroll_info == NULL but doesn't check if device itself is NULL.

   Fix in clutter/clutter/clutter-input-device.c:

    void
    _clutter_input_device_reset_scroll_info (ClutterInputDevice *device)
    {
      guint i;
    
   +  if (device == NULL)
   +    return;
   +
      if (device->scroll_info == NULL)
        return;

   We've built this as a proper Debian package via dpkg-buildpackage (muffin 6.6.3) together with fixes for #807 and #769, and it's running stable.
5. github-actions

   removed

   stale

   on Mar 8, 2026
6. giang9910 commented on Oct 12, 2026

   

   giang9910

   on Oct 12, 2026

   More actions

   Still happening on Linux Mint 22.3 (Zena), Cinnamon 6.6.9, muffin 6.6.3+zena, Xorg 1.21.1.11 (AMD GPU). Same backtrace (segfault at e0, meta-seat-x11.c:2310). I dug into the core with muffin-dbg, and I think I found the root cause. The NULL is a symptom.

   What the core shows

   #0  _clutter_input_device_reset_scroll_info (device=device@entry=0x0) at ../clutter/clutter/clutter-input-device.c:1914
   #1  meta_seat_x11_translate_event (...) at ../src/backends/x11/meta-seat-x11.c:2310
   
   (gdb) frame 1
   (gdb) p *(XIEnterEvent*)xi_event
   { ..., evtype = 7 /* XI_Enter */, deviceid = 2, sourceid = 24, ... }
   

   sourceid = 24 is a uinput virtual pointer (/sys/devices/virtual/input/...) that a user service created at login. Muffin's seat->devices_by_id has no entry for id 24, even though xinput list shows it as an enabled slave pointer attached to the VCP.

   Timeline (single login)

   time	event
   22:23:57.6	uinput device created; Xorg: XINPUT: Adding extended input device ... (type: MOUSE, id 24)
   ~22:23:58	cinnamon --replace starts, meta_seat_x11_constructed() runs
   22:24:06	first XI_Enter sourced from id 24 → source_device == NULL → SEGV

   Root cause: race in meta_seat_x11_constructed()

   info = XIQueryDevice (..., XIAllDevices, &n_devices);   // (1) snapshot devices
   for (...) {
       if (!xi_device->enabled)
         continue;                                         //     not-yet-enabled devices skipped
       add_device (...);
   }
   ...
   XISetMask (mask, XI_HierarchyChanged);
   XISelectEvents (xdisplay, root, &event_mask, 1);        // (2) only now listen for hotplug

   If a device is added or enabled between (1) and (2), muffin never sees it. It isn't in the snapshot, and the XIDeviceEnabled hierarchy event arrives before muffin has subscribed. The device then stays unknown for the life of the process, and the first XI_Enter/XI_Leave from it crashes at line 2310. That line is the only place in this switch that passes source_device without a NULL check (XI_DeviceChanged just above guards it).

   This explains why the crash shows up "shortly after login, while moving the mouse" and only sometimes. Login is exactly when apps that create virtual input devices start, such as Steam (60-steam-input.rules, Steam Input uinput devices; the original report has Steam autostarting), Solaar, input-remapper, and custom uinput filters. They race Cinnamon's startup.

   Suggested fix

   1. Select XI_HierarchyChanged before calling XIQueryDevice. translate_hierarchy_event() already ignores devices that are present in devices_by_id (XIDeviceEnabled && !g_hash_table_lookup (...)), so a device that appears in both the snapshot and an event is handled correctly.
   2. Defensively, guard line 2310 the same way XI_DeviceChanged does:

      if (source_device)
        _clutter_input_device_reset_scroll_info (source_device);

      (The NULL guard inside _clutter_input_device_reset_scroll_info proposed above also stops the crash, but the device remains invisible to muffin, so (1) is the real fix.)

   Reproduce (from reading the code, not a deterministic repro)

   Create a uinput pointer (e.g. python-evdev UInput) while cinnamon --replace is starting, then move the pointer across a window/stage boundary. The window is short, so this only hits sometimes. On this machine the same uinput service has run at every login for ~8 days, and this is the only crash. Per the code, a device created after the seat is constructed goes through the normal hierarchy path, and one that already exists when Cinnamon starts is in the snapshot, so neither case should crash.